As of September 9, 2025, the JavaScript ecosystem is responding to a major supply-chain attack that compromised the NPM account of the popular.